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(57) Abstract 

A control system for detonating a plurality of blast explosives is programmable to receive and store an arming sequence 
and firing sequence which is compared with an operator entered command. The system generates both an ARM signal and a 
FIRE signal, wherein the ARM signal initiates a charge circuit (26) to charge up a detonation circuit (54) and the FIRE command 
releases the charge to fire the circuit. The firing sequence contains a programmable delay (66) making sequential blasting possi- 
ble. The system is designed to fail safely in the event both the ARM signal and the FIRE signal do not appear within a predeter- 
mined time frame. 
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ELECTRONIC CONTROL SYSTEM FOR EXPLOSIVES ■ ■ 
BACKGROUND OF THE INVENTION 

Field of the Invention 
The invention relates generally to electronic detonator 
units and control systems for blasting operations, and par- 
ticularly to secure programmable digital electronic sequen- 
tial detonator systems. 



Description of the Prior Art 
Electronic detonators for discharging and igniting 

10 pyrotechnic devices in blasting operations have been available 
for at least 25 years, African Explosives and Chemical 
Industries, Ltd., now AECI, Ltd., pioneered some of the early 
developments in this field and a number of designs offered by 
AECI illustrate the advancement of the technology. 

15 In the mid-6 0s, AECI developed a method for sequential 
activation of explosive detonators by electrical means, 
utilizing a pulse generator connected to a plurality of 
detonators. The pulse generator passed an electrical current 
through the first detonator in sequence, the current having a 

20 magnitude sufficient to energize and discharge the first 
detonator, the second detonator being initially charged upon, 
discharge of the first, in sequential fashion. The energization 
of each detonator in the series was dependent upon the dis- 
charge of the detonator just ahead of it in the series- In 

25 electrical systems such as these, the current in the detonator 
charging circuit was sufficient to activate and fire the 
detonator, that is, the signaling circuit and the charging 
circuit were one and the same. 

The next significant advance in the art f also by AECI, was 

30 the development of low energy signaling circuits to be used in 
conjunction with high power detonation circuits. In one such 
device, a network of propagating units was coupled to a like 
network of full strength detonators. As each propagator unit 
was energized in sequence by the low power signal, it would 

35 close a power circuit to the detonator and energize it for 
discharge. This system was advantageous over earlier systems 
in that it permitted use of a more accurate low power control 
signal to control the sequencing and triggering of the high 
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power detonator, relying on full power for energization while 
not using full power for control. 

More recently, solid-state circuitry has been incorporated 
in sequential detonator systems, wherein the triggering. 
5 circuitry is made up of low-level digital electronic components 
for triggering each high power detonator in the series via a 
relay and switching control system. These devices were more 
accurate and reliable than either analog or hard wired devices. 
While the more recent advances in the art have provided 

10 more reliable low powered detonator systems, there remain many 
disadvantages in the detonator systems of the prior art. For 
example, safe, methodical shutdown in the event of signal error 
has been largely ignored. Programming has been complex and 
time consuming, and re-arming after shutdown or misfire has 

15 typically required a complicated rewiring procedure. Further, 
neither redundant comparison and confirmation of proper signals 
during operation, nor unauthorized operation lockout has been 
previously successful in a cost-efficient manner. 

20 SUMMARY OF THE INVENTION 

The detonator control circuit of the subject invention, 
seeks to overcome the disadvantages of the prior art by 
providing an intelligent, secure detonator unit which is 
inexpensive to manufacture, easy to use, and provides substan- 
25 tially improved fail safe, security and shutdown features. 

The detonator unit comprises a solid-state electronic 
programmer module for receiving programmed sequencing and 
firing data, and generating ARM and FIRE signals in accordance 
with the program data in response to a command sent from the 
30 programming or master computer. The programmer module is 
computer compatible so that all programmed input may be 
controlled by a host computer. 

The detonator unit includes a low energy, fail safe dropout 
feature preventing units from detonating after a predetermined 
35 period of time in the event an accurate firing signal has not 
been generated. The unit permits a predetermined number of ref 
ire attempts in the event of dropout, prior to shutdown. 

It is, therefore, an object and feature of the invention 
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to provide a programmable , secure detonator unit using low 
energy control signals to charge and fire a high energy 
detonator . 

It is another object and feature of the invention to 
5 provide a detonator unit with secure, redundant, fail safe 
firing and, if necessary, shutdown procedures. 

A further object and feature of the invention is to provide 
a cost-efficient detonator unit which can be easily programmed 
and reprogrammed for secure, fail safe use. 
10 Other objects and features of the invention will be readily 
apparent from the drawings and description which follow. 

BRIEF DESCRIPTION OF THE DRAWINGS 
Fig. 1 illustrates a hand -held computer compatible 
15 programmer for the detonator unit of the subject invention. 

Fig. 2 is a diagrammatic side view of the interior of the 
detonator unit. 

Fig. 3 is an overall system block diagram for the detonator 
unit. 

20 Fig. 4 is a functional block diagram of the sequencing, 
arming and firing circuitry of a detonator unit made in , 
accordance with the subject invention. 

Fig. 5 is a detailed schematic diagram of the decoder unit 
illustrated in Fig. 4. 
25 Fig. 6 is a detailed schematic diagram of the program 
module and delay circuitry shown in Fig. 4. 

Fig. 7 is a detailed schematic of the control registers 
of the detonator unit shown in Fig. 4. 

Fig. 8 is a detailed schematic of the sequencer circuit 
30 and safety time-out circuit of the detonator unit shown in Fig. 
4. 

Fig. 9 is a detailed schematic of the fire circuit of the 
detonator unit shown in Fig. 4. 

Fig. 10 is a detailed schematic of the charge module and 
35 detonator circuitry of the detonator unit shown in Fig. 4. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
As shown in Fig. 1, the detonator control unit of the 
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present invention is adapted to include the hand-held programm- 
ing module or programmer 10, having a computer compatible 
programming feature and adapted for connecting the module to 
a host computer at interface connector 12. The module includes 
5 a keypad 14 for entering firing codes to discharge the 
detonators. The control and FIRE signals may be hard wired to 
the detonators through cable 16 or may be transmitted by a wire 
less radio transmitter and receiver, as shown here (Figs. 2 and 
3). The programmer 10 includes a display panel 18 which 

10 provides the operator with a readout of the firing command 
entered and a status of the program after programming has 
commenced at address line 20. Information as to the status of 
the charge on the charging module or battery is displayed at 
line 22, and the program delay cycle is displayed at line 24. 

15 As shown in Fig. 2, the control module. is hermetically 
sealed and is impervious to temperature and humidity. The 
control module 32 and charging circuit 26 are designed to fit 
in a control module 10 of approximately 20 millimeters x 125 
millimeters x 70 millimeters, and can be easily hand held. An 

20 aperture 36 is provided in one end of the control module 10 or 
passing the fuse leads 40 and the transmitter antenna 42. A, 
hermetic sealant 43 seals the hole against moisture and other' 
contaminants. The fuse leads are connected directly to the 
detonator firing circuit and the control signals are trans- 

25 mitted via radio waves to a receiver associated with the 
detonator at the blast site. Alternatively, the programming 
function and energy control function may be carried out by 
separate hand-held units based on the desired application of 
the detonator unit. 

30 The system block diagram of Fig. 3 illustrates how the 
program and detonator module fit within an operating system. 
The master computer 50 is hard wired to the programmer 10 
through the computer interface connector 12. The control 
module transmits firing energy directly to the receiver 

35 detonator 54 by the fuse leads 40. The programmer 10 and 
computer 50 are linked to the radio transmitter 41 for sending 
control and fire commands to each of the detonator circuits 54, 
each of which include a receiving antenna 52. As shown, the 
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detonator unit can control up to 256 separate receiver 
detonators . 

Typically, the master computer 50 is used to provide 
control and sequencing data to the programmer 10 • A series of 
5 receiver/detonators 54 and associated blast charges including 
blasting caps are strategically placed at the blast site. The 
blasting caps are typically hard wired through fuse leads 40 
to the detonator module 10. When the program data is properly 
entered, the operator enters a unique, secure firing code on 

10 the keypad of the programmer 10. If this matches the security 
code entered through the computer, the control and signal data 
are transmitted to the detonator 54 by the transmitter 41 , 
antenna 42 and antenna 52, and the detonator module 10 
simultaneously initiates the charge cycle for charging the 

15 charge module 26 (Fig. 4). At the programmed time, the charge 
is discharged via fuse leads 40 and energizes the detonator 54 
for triggering the blast, as controlled by the control and FIRE 
signals received from the transmitter 41. 

A functional circuit diagram is shown in Fig- 4. It will 

20 be understood that the modules and circuits there shown are for 
functional clarity only and are not intended to represent any, 
physical configuration or any relationship relative to the 
modules described in Figs. 1-3. The functional diagram is 
supported by the detailed schematics of Figs. 5-10, and the 

25 appropriate figure (Fig.) number identified in each block of 
the diagram of Fig. 4 contains a substantially complete 
schematic for the module or circuit identified. 

The detonator unit includes low-cost electronic control 
circuitry for energy storage and secure communications as shown 

30 in control module 10. The unit is designed to respond to a 
coded, secure, precisely timed transmission by delaying a 
programmable time interval and delivering a high energy, short 
duration electrical pulse to activate a detonator and blast 
explosive. The system can be programmed with a distinct code 

35 from 1 to 256, thereby allowing up to 256 detonations in a 
single program cycle. Discrete time delays for each detonator 
can be programmed, allowing sequencing of explosive charges to 
occur. A fail safe, low energy, dropout feature prevents the 
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detonators from detonating after a fixed period of time. The 
programmer module 10 is controlled by a host computer and is 
designed to include fail safe operation for the trigger 
command, including improper code lockout. The detonator 
5 control circuit of the invention also includes features to 
prevent random generation of the firing code. A remote 
transmitter assembly may be utilized to minimize RF radiation 
and pickup. As illustrated in Figs. 4-10, the device is 
structured to be integrated into one or two custom CMOS LSI 

10 circuits. Basically, the circuit design includes nine separate 
modules. As illustrated, the circuitry uses conventional SSI 
and MSI devices. Standard engineering nomenclature is used. 

Referring specifically to Figs. 3 and 4, the specific 
sequencing and firing commands are entered into the program 

15 module 10 via the computer 50. At this time, unique firing 
codes are also entered. This program data is stored by the 
control register circuit 60 and is loaded into the com- 
parator/decoder circuit 62 once the firing sequence is 
initiated. An operator enters a firing code into the program 

20 module 10 and this is compared by the decoder circuit 62 with 
the programmed firing code previously entered via the computer. r 
If the codes match, the firing sequence is initiated. 

Assuming a firing sequence is properly initiated, the 
control register circuit 60 outputs an ARM signal to the charge 

25 module 26 , initiating an electrical energy charge sufficient 
to energize the detonator 54 . The control register circuit 60 
also sends a signal to the fire circuit 64 to accept the FIRE 
command entered at programmer 10. At this time, a predeter- 
mined programmed delay is initiated by the delay circuit 66, 

30 for delaying the generation of a FIRE signal by the fire 
circuit 64 . The sequencer 68 determines the proper timing cycle 
of the unit and assures that the ARM signal is sent to the 
proper detonator 54 via the charge module 26. When the delay 
is complete, a FIRE signal is generated by the fire circuit 64 

35 and the charge module releases a triggering pulse to the 
selected detonator 54. The circuit is designed so that both 
an ARM and a FIRE signal must be present at charge module 26 
before a trigger pulse can be released. If either signal is 
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absent for any reason, the system is rendered inoperative. 

The safety time out circuit 70 confirms that once the ARM 
signal has been generated within a specified period of time, 
the signal generated by the delay circuit 66 is also present. 
5 In the event the delay timer does not produce an output within 
a predetermined period of time, the safety time out circuit 
generates a signal to reset the control registers, rendering 
the circuit temporarily inoperative. After reset, the system 
repeats all sequences in a "retry" mode. If after the 

10 programmed number of retries the ARM and FIRE signals are not 
present within the specified period of time, the safety time 
out circuit 70 generates a "dump" signal to remove or dump all 
information in the control register circuit 60 and the decoder 
circuit 62, and to discharge the charge module 26, rendering 

15 the system inert until it is reprogrammed. 

It should be appreciated by those skilled in the art that 
only one embodiment of the invention is illustrated by the 
specific electronic schematic diagrams of Figs. 5-10. It 
should also be appreciated that all modifications to these 

20 specific schematic diagrams (Figs. 5-10) and other configura- 
tions of electronic circuitry are contemplated by the present, 
invention and fall within the scope of the claims herein. In 
the schematic diagrams of Figs. 5-10, standard design electri- 
cal/electronic nomenclature is utilized. Where required, the 

25 circuit components are identified by the standard component 
part number adapted by integrated circuit component manufac- 
turers. Furthermore, the various signal lines continuing from 
one figure of the drawings to another are identified by 
matching reference numerals in all figures. For example, line 

30 6A in Fig. 5 is continued as line 6A in Fig. 7. 

Turning now to Fig. 5, a combination of the logic elements 
used in the decoder circuit 62 for bit timing, counting and 
decoding is shown in schematic form. The incoming serial data 
stream is controlled through a modulation scheme. Preferably, 

35 a modified "return to 0" modulation scheme having a six mil- 
lisecond bit time is utilized. Each bit preferably has a 
rising edge at its beginning. In the illustrated embodiment, 
a logic 0 is represented by a 1 millisecond/ 5 millisecond 
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on/ of f ratio while a logic 1 is represented by a 5 mil- 
lisecond/1 millisecond on/off ratio . The rising edge of each 
bit serves to resynchronize the bit timer consisting of the 
HC390 circuit U14 and the HC4017 circuit U15. The HC74 
5 flip-flops U1A and U1B form the demodulator for the incoming 
data stream and are preferably "D" type or "Data" flip-flips. 
The HC4024 binary counter U2 is used to direct the signals to 
the various parts of the circuitry based upon total bits, 
detected. The circuit concept is based upon the utilization 

10 of an ARM command and a FIRE command. These signals are 
independently generated and sent, and are separated in time by 
a time, interval, preferably a minimum of 1 second. The ARM 
command consists of a 32 bit sequence and the FIRE command 
consists of an 8 bit sequence. The HC74 flip-flop U3A is set 

15 after the receipt of the 32nd bit and generates a greater than 
32 bit signal. The HC74 flip-flop U3B is set after the receipt 
of the 40th bit and is used to start the timer if both FIRE and 
ARM codes have matched by generating a greater than 40 bit 
signal. Timing is initiated only after a proper match of all 

20 40 bits has been detected. 

As shown in Fig. 6 and Fig. 9, the programmer module 10, 
includes a series of 8 bit HC595 registers U34-U41. These 
registers contain the data bit patterns for the ARM code, FIRE 
code, delay time and detonator identification. These registers 

25 are programmed initially through the programmer 10 and are 
entered into the program at the "data-in" signal point 72 (Fig. 
6) . These registers define the primary data registers for the 
unit. All data received by the serial registers is compared 
to these bit patterns. The first 16 bits in the HC595 shift 

30 registers U35 and U34 (see Fig. 9) contain the detonator 
identification information and are not used internally within 
the device. The HC595 shift register U41 (also Fig. 9) 
contains the 8 bit delay time representation. In Fig. 6, shift 
registers U36, U37, U38 and U39 contain the ARM code. Shift. 

35 register U40 contains the FIRE code. A state machine sequencer 
(Fig. 8) , described herein, is used to perform the comparisons 
between the data pattern in these registers and the data 
registers . 
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The schematic for the control register module 60 of Fig. 
4 is shown in Fig. 7. The control register module consists of 
five sequential 8 bit HC595 shift registers U25, U26, U27, U28 
and U29. These devices make up the data registers within the 
5 detonator control system. The data which is detected by the 
RF receiver is sequentially shifted into this register chain. 
Upon the receipt of the 32nd bit of input data, steering logic 
in the decode circuit 62 redirects the data to the shift 
register U29, i.e. , the next 8 bits are directed into the FIRE 

10 code register U29. After receipt of the 32nd bit, the state 
machine in the sequencer network 68 begins operation. 

The sequencer circuit 68 is illustrated in Fig. 8. 
Basically, the sequencing circuit comprises a sequential state 
machine. Its purpose is to do a byte-by-byte comparison 

15 between the program data registers U36, U37, U38, U39 and U40 
and the control register mode namely data registers U25, U26, 
U27, and U28. The sequencer comprises the HC4017 module 
designated U18. After the receipt of the 32nd bit, the 
sequencer starts its cycle. The 4 bytes in data registers 

20 U25-U28 are sequentially compared with the 4 bytes in the 
programmed ARM code register. The comparisons are done, 
byte-by-byte by comparator U31 (Fig. 7) . Match or mismatched 
data is stored in the four independent KC74 flip-flop circuits 
U32A, U32B, U42A and U42B. Flip-flop circuits U32A, U32B, U42A 

25 and U42B are preferably "D" or "Data" type flip-flops. If a 
match has occurred on all 4 pairs of registers, then an ARM 
signal is generated at the HC11 gate U33 on pin 6. After the 
32nd bit has been received, the steering circuitry in the 
decoder 62 redirects the input data to the FIRE code register 

30 U29. When 8 bits have been shifted into FIRE code register U29, 
the greater than 40 bit signal is generated. This signal is 
delayed and used to sample the register comparator for FIRE 
code match. If a match is then detected between the FIRE code 
control register and the programmed FIRE code register, a FIRE 

35 signal is generated. This FIRE signal is conditioned with the 
ARM signal and then serves to enable the delay timer 66 of Fig. 
4. 

The delay timer consists of a precision timer accurate to 
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1 millisecond. Preferably, the timer is programmable in 
increments from 1 millisecond to 25. milliseconds, but this 
range could be varied as necessary based on the particular 
application desired. The illustrated embodiment herein 
5 includes an 8 bit counter and an 8 bit comparator. The timer 
enable signal ("TIMEREN") releases the divider chain formed by 
the counters of the HC390 modules 48A and 48B (Fig. 9) . The 
output of these two centers is a 1 millisecond clock. The 
reset state of the delay timer is 0. To ensure the safe and 

10 proper operation of the detonator unit, the reset state of the 
delay timer has been decoded and is not used as a delay time. 
A minimum delay of 1 millisecond from the receipt of the 40th 
bit will be used, however, various delay times are attainable 
by this invention. The comparator output generates both a FIRE 

15 and NOT FIRE signal. These inverse signals are precautionary 
in nature and are used to ensure safe operation of the 
detonator unit and preclude single gate failures from causing 
an early trigger. 

The fire module 64 is illustrated in Figs. 6 and 9. This 

20 module consists of a time base generator and includes the latch 
delay circuit 66, also illustrated in Fig. 6. The timer, 
comprises a 4060 oscillator (U45) , a 4024 binary counter (U46) , 
an HC74 "D" or "Data" type flip-flop (U47) . Time base 
generation is preferably performed by the 4060 RC CMOS 

25 oscillator (U45) . A 4024 counter (U46) follows the oscillator 
and generates various clocks for use within the device. The 
latch delay generator is used in conjunction with the 4024 
counter (U46) and the HC74 flip-flop (U47). The counter is 
reset with the shift clock signal from the programmer 10 (line 

30 7B) . When the programmer is connected and data is being 
shifted into the 8 shift registers (U25-U28 and U36-U39 of Fig. 
6) the counter is held at reset. When the programmer is 
disconnected, the counter is allowed to count up and after 
approximately 1/2 second, accomplishes transfer of the data 

35 from the shift registers to the output latches (D6-D7 of shift 
registers U25-U28 and U36-U39) . This mil preclude a shifting 
data pattern from causing output transients within the 
detonator unit. 
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The charge module 26 and detonator circuit 54 are il- 
lustrated in Fig. 10. The circuit consists primarily of a 
regulator and charge pump. A low power ICL7663CPA regulator 
U56 is used to supply all of the logic on the system. There 
5 are a series of N-channel MOSFETS used to hold the charge on 
the energy storage devices to 0 except when the device is 
armed. When an ARM command has been received, and a match 
detected, the MOSFETS Q2 and Q3 present power to the charge 
pumps U57 and U58, comprising ICL7662CPA modules. With a 

10 proper ARM command, the FETs Q6, Q5 # Q8, and Q7 are all 
effectively removed from the circuit. The P-channel MOSFET Q2 
allows current stored in the external capacitor C13 to be 
introduced into the first charge pump U56. The voltage level 
on the capacitor C13 is then doubled and presented to the 

15 charge pump U58. A second doubling occurs, pumping current 
into the capacitor C55. As charges are transferred from the 
external storage capacitor C13 to the fire storage capacitor 
C55, the voltage on capacitor C13 is reduced. This aspect of 
operation of the illustrated circuit provides the charge module 

20 22 with the proper input to effectively increase the energy 
available at fire storage capacitor 55 and is necessary for. 
proper operation of the charge module. The N-channel FET Q4 
is provided to dump the charge from the external storage 
capacitor C13. A charge dump is initiated by the safety time 

25 out circuit 70 of Fig. 8 and will render the system inoperative 
and unable to perform detonation. 

The firing circuitry for detonator 54 is also shown in 
Fig. 10. Two series P-channel FETs Q9 and Qll are used. 
Energy stored on the fire charge storage capacitor C55 is 

30 presented to the detonator 54 when both MOSFETS Q10 and Q12 are 
properly biased. A separate gating function is provided to 
combine the FIRE, ARM, and NOT FIRE signals. It should be 
recognized that the voltage level on the external storage 
capacitor C13 is not high enough to in itself trigger the 

35 detonator. It is only after the operation of charge module 22, 
described above, that the energy is stored at a level suffi- 
cient to trigger detonator 54. 

As shown in Fig. 8, the safety time out module 70 includes 
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two distinct safety time out systems. After receipt of an ARM 
code, a 62 second timer, comprising the 4024 binary counter 
(U21) and the HC74 "D" or "Data" type flip-flops U22, U22A and 
U22B, is started. If after 62 seconds the unit has not been 
5 fired, a reset command is issued to the ARM and FIRE code 
register. This reset command also resets the bit counter 
comprising the circuits of U2, U3A and U3B in the decoder (Fig. 
5) . This allows recovery from a faulty transmitted sequence, 
noise, or other interference with the proper triggering of the 

10 system. As here shown, the disarm timer has been provided with 
a four try capability. If after the fourth attempted arming 
sequence, a match has not occurred, then the system will be 
rendered inoperative by causing the dump signal to be asserted 
at the output of the gate U20. The number of tries is 

15 programmable and arbitrary. An additional time out is provided 
at approximately 62 minutes. At this time it is assumed that 
a fault in the triggering sequence has occurred. The system is 
again rendered inoperative by assertion of the dump signal and 
discharging the external storage capacitor C13. 

20 While certain features and embodiments of the invention 
have been described in detail herein, it will be understood, 
that the invention encompasses all modifications and alterna- 
tives within the scope and spirit of the following claims. 

25 CLAIMS 
What is claimed is: 

1. A control system for sequential detonation of blast 
explosives comprising: 

a. means for receiving and storing a programmed 
30 signal representing the timing sequence and firing sequence of 
the detonation of each explosive; 

b. means for receiving and storing a fire command 
to initiate the timing sequence and the firing sequence; and 

c. control means for comparing the fire command with 
35 the programmed signal, and responsive to a predetermined 

correspondence thereof for initiating the timing sequence and 
the firing sequence. 

2.. The control system of Claim 1, the control means 
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further comprising means for generating a FIRE signal and an 
ARM signal in response to the predetermined correspondence of 
the fire command and the programmed signal, wherein the 
initiation of the firing sequence is responsive only to the 
5 presence of both the FIRE and ARM signals. 

3. The control system of Claim 2, further comprising: 

a. a detonator firing circuit; 

b. means for generating a firing charge sufficient 
to detonate a blast explosive and for releasing said charge to 

10 the detonator firing circuit; and 

c. means for delaying the generation of the FIRE 
signal for a predetermined time after the generation of the ARM 
signal, said charge generating means responsive to the ARM 
signal for generating said firing charge and responsive to the 

15 FIRE signal for releasing said firing charge to the detonator 
firing circuit. 

4 . The control system of Claim 3 , further comprising means 
for disabling the charge generating means when said FIRE signal 
is not generated within a predetermined time of said ARM 

20 signal. 

5. The control system of Claim 1, wherein the programmed, 
signal and the fire command each comprise a sequential series 
of binary bit signals, said control means including comparing 
means for making a bit-by-bit comparison thereof. 

25 6. The control system of Claim 3, the firing charge 
generating means comprising a plurality of charge means for 
generating at least a portion of said firing charge connected 
in sequential relationship with one another, each succeeding 
charge means in sequence for generating a multiple of the 

30 charge generated by the charge means immediately in advance 
thereof . 

7. The control system of Claim 6, wherein said charge 
means includes electrical charge pump circuitry. 

8. The control system of Claim 4, further comprising means 
35 for deleting the fire command from the storing means when said 

FIRE signal is not generated within a predetermined period of 
time after the ARM signal. 

9. The control system of Claim 8, further comprising means 
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